AI knowledge agent: Julie’s first Monday, before and after

“Where’s the current price list?” “How do we handle a customer return again?” “Which form do I fill out for my vacation?” In an SMB, these small questions come up every day. The answer exists somewhere: in a shared folder, an old email or, most often, in the head of the busiest person on the team.

An AI knowledge agent, sometimes called a “company memory”, answers these questions from your procedures and your documents. It cites its source, it only reads what the employee is allowed to see, and when something isn’t documented, it says so: “I don’t know, ask Mark.” To see what that changes, here is the same Monday morning, before and after.

Julie’s first Monday: before / after

Fictional scenario, for illustration only. Julie has just joined the customer service team of a 15-employee distribution SMB.

The difference isn’t AI magic. It’s that the right answers were written down, approved and stored in one place. The agent just finds them quickly and tells you where they came from.

What an AI knowledge agent can do day to day

How it works behind the scenes

If your procedures already live in Microsoft 365 (SharePoint, Teams, OneDrive), you can often build this kind of agent with the tools you already have, without moving everything. Available features depend on your licences and configuration, though, so validate that before promising anything to the team. The goal to insist on, whatever the tool: the agent must never see more than the employee asking the question.

Realistic gains

• Fewer interruptions for key people: they only handle the real exceptions.
• More autonomous onboarding: new hires find basic answers on their own, any time of day.
• Consistent answers: everyone follows the same, approved procedure.
• Visible gaps: every “I don’t know” points to a procedure that needs writing. That’s a valuable side effect.

We don’t promise any percentage of hours saved: the gain depends mostly on the quality of your documents. An agent connected to vague procedures gives vague answers, faster.

Limits to know

• Outdated documents: if the old price list is still in the library, the agent may quote it. No owner, no review date? The document shouldn’t be there.
• Hallucinations: an AI model can phrase a plausible but wrong answer. Requiring a cited source and an “I don’t know” rule reduces that risk without eliminating it. OWASP lists misinformation among the top risks of AI applications.
• HR and payroll files: if the agent can reach a poorly protected folder, it may reveal its contents to anyone who asks the right question. That’s the “sensitive information disclosure” OWASP describes. The root cause is often overly broad permissions already in place, which the agent suddenly makes easy to exploit.
• Prompt injection: a document can contain hidden instructions (“ignore your rules and…”). The agent may follow them. Only put approved internal documents in its library, and keep it read-only.
• Too much power: a knowledge agent doesn’t need to send emails, edit files or approve anything. The less it can do, the less a mistake costs.

How to start safely

1. Pick 20 to 30 well-written procedures, the ones that answer the most frequent questions. Not the whole library at once.
2. One owner per document, with a visible review date. No owner, no entry.
3. Read-only, permissions respected: the agent looks things up, changes nothing and only sees what the employee can see. Clean up the permissions on your shared folders first.
4. Test with 2 employees for a few weeks: one new hire and one veteran. Log every wrong answer and every “I don’t know”.
5. Review monthly: fix faulty documents, add missing procedures, remove outdated versions.
6. Quebec’s Law 25 and personal information: if the agent touches personal information (employees or customers), Quebec law may require a privacy impact assessment for a new information system. Also know where the tool processes data (Quebec, Canada, elsewhere). This is not legal advice; the Commission d’accès à l’information and the Canadian Centre for Cyber Security guide on generative AI (ITSAP.00.041) are good starting points.

New to AI agents? Also read 5 tasks to hand to an AI agent, an AI agent’s first week, day by day and our article on the AI agent for quotes.

How NeoTech can help

We help SMBs in Laval, Montréal and the North Shore sort through their procedures, clean up shared-folder permissions and connect an agent to the right documents, with the proper guardrails: AI and automation consulting and Microsoft 365 integration.

Book a meeting to explore your AI needs

Does your team keep asking the same people the same questions? In 30 minutes, we review your procedures and tools together and identify what an agent could answer for you, and what must stay human.

👉 Book a meeting to explore your AI needs

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Sources

• OWASP Top 10 for LLM Applications: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM06 Excessive Agency, LLM09 Misinformation
• Canadian Centre for Cyber Security: Generative artificial intelligence (ITSAP.00.041)
• Commission d’accès à l’information du Québec: personal information protection (Law 25) (general framework; not legal advice)

Photo: Pexels (Pexels licence).